PT-2004-3321 · Enderunix · Spamguard

Published 2004-12-31 · Updated 2017-07-11 · CVE-2004-2429

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions: EnderUNIX spamGuard versions prior to 1.7-BETA

Description: The issue is related to multiple stack-based and heap-based buffer overflows that allow remote attackers to execute arbitrary code. The overflows occur in various functions, including (1) qmail parseline and (2) sendmail parseline in parser.c, (3) loadconfig and (4) removespaces in loadconfig.c. There are also possibly unspecified functions in functions.c that are affected.

Recommendations: For versions prior to 1.7-BETA, update to version 1.7-BETA or later to resolve the issue. As a temporary workaround, consider restricting access to the affected functions until a patch is available.

Fix

Related Identifiers

CVE-2004-2429

Affected Products

Spamguard

References · 10

• https://nvd.nist.gov/vuln/detail/CVE-2004-2429 · Security Note
• http://osvdb.org/6521 · Patch
• http://securityfocus.com/bid/10434 · Patch
• http://secunia.com/advisories/11747 · Patch
• http://securitytracker.com/id?1010342 · Vendor Advisory
• http://archives.neohapsis.com/archives/bugtraq/2004-05/0298.html · Vendor Advisory
• http://osvdb.org/6523 · Patch
• http://osvdb.org/6522 · Patch
• http://enderunix.org/spamguard/spamguard-1.7/CHANGELOG · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/16278 · Note